jakman85andClaude Opus 5.5
c3c72c47bb
Scheduled Gitea Actions bot in the Renovate shape: maintains a counts-only CVE Dashboard issue, derives remediation states from Renovate's dashboard and PRs, ticks approve rows for exact-matched images with an unaccepted CRITICAL with a fix, and posts the heartbeat. Co-Authored-By: Claude Opus 5.5 <[email protected]>
33 lines
1.6 KiB
YAML
33 lines
1.6 KiB
YAML
# =============================================================================
|
|
# L1 RENDERING — the bot ticks only qualifying approve rows (R-VULN-05, R-VULN-07)
|
|
# Spec: docs/17 "The triage bot" and its L1 acceptance gates. GIVEN a Renovate dashboard in the
|
|
# real issue #91 format plus a constructed Pending Approval section, WHEN the bot plans ticks,
|
|
# THEN only `approve` rows exact-matching an image with an unaccepted CRITICAL with a fix change,
|
|
# by exactly their marker, and every negative row stays byte-identical.
|
|
#
|
|
# render-check.sh is a pure offline check; this Chainsaw Test wraps the SAME script.
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: vuln-triage-bot-approval-ticks
|
|
labels:
|
|
conformance.home.k3s/R-VULN-05: "true"
|
|
conformance.home.k3s/R-VULN-07: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-VULN-05,R-VULN-07"
|
|
conformance.home.k3s/layer: "L1"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
# The script under test lives in .gitea/workflows/, which requirement-scoped selection does
|
|
# not attribute to R-VULN-*, so a change to it must still select this test.
|
|
conformance.home.k3s/scope: "whole-repo"
|
|
conformance.home.k3s/intent: >-
|
|
A tick is applied only to an approve row for an image with a qualifying finding, and dry
|
|
runs, duplicate prevention and heartbeat ordering hold through the whole run.
|
|
spec:
|
|
steps:
|
|
- name: plan-and-assert-ticks
|
|
try:
|
|
- script:
|
|
content: bash ./render-check.sh
|